socket-cli/.github/workflows/on-device-model-cache.yml at main · SocketDev/socket-cli · GitHub

View runs

History

292 lines (272 loc) · 13 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

# Fleet-canonical on-device model cache. The fleet's keyless-AI lane (the

# weekly-update decision leg, every odai-driven assist) needs the on-device

# model present on a fresh runner: this proves the chrome-builtin backend

# runs on a public ubuntu runner, fills the ~4 GB Gemini Nano component into

# a cacheable profile, and verifies a FRESH runner restores it and prompts

# offline.

# The weekly schedule is load-bearing twice over: Actions caches evict after

# 7 idle days, and prune-actions-caches never evicts an entry accessed within

# its fresh window — a weekly touch keeps the one 4 GB profile entry both

# alive and prune-protected.

# Unlike the fleet seam (exit 69 = clean skip), this workflow FAILS LOUD on

# an unavailable backend: its whole job is evidence.

# Chrome installs at current stable, version logged in the receipts —

# Google's deb pool does not retain old versions, and Chrome auto-updates

# the model component regardless, so the receipts record versions instead

# of pretending a pin.

on:

workflow_dispatch:

schedule:

- cron: '17 6 * * 1'

permissions:

contents: read

concurrency:

group: on-device-model-cache

cancel-in-progress: false

env:

ODAI_PROFILE_DIR: /home/runner/.cache/odai/chrome-builtin

jobs:

fill:

runs-on: ubuntu-latest

timeout-minutes: 50

outputs:

component-version: ${{ steps.component.outputs.version }}

cache-key: ${{ steps.component.outputs.cache-key }}

steps:

- name: Bootstrap checkout

shell: bash

env:

GITHUB_TOKEN: ${{ github.token }}

SERVER_URL: ${{ github.server_url }}

REPOSITORY: ${{ github.repository }}

TRIGGER_REF: ${{ github.ref }}

run: |

set -euo pipefail

git init -q

git config --local advice.detachedHead false

git remote remove origin 2>/dev/null || true

git remote add origin "${SERVER_URL}/${REPOSITORY}"

FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}")

if [ -n "${GITHUB_TOKEN}" ]; then

AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"

git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}"

else

git fetch "${FETCH_ARGS[@]}"

git checkout -q --detach FETCH_HEAD

# The model download wants ~22 GB free and Chrome REMOVES an installed

# model when free disk drops under 10 GB — the stock runner image does

# not leave that headroom, so the unused preinstalled toolchains go.

- name: Reclaim runner disk

shell: bash

run: |

set -euo pipefail

df -h / | tail -1

sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc \

/usr/local/.ghcup /opt/hostedtoolcache/CodeQL

df -h / | tail -1

- name: Install Google Chrome stable

shell: bash

run: |

set -euo pipefail

wget -q https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb

sudo apt-get install -y ./google-chrome-stable_current_amd64.deb

rm google-chrome-stable_current_amd64.deb

google-chrome-stable --version

- uses: ./.github/actions/fleet/setup-and-install

with:

socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}

# Thin-distribution CI auth: mint a contents:read-only token so the

# bootstrap fetch (fired by `prepare` during install) can download the

# fleet release bundle from the private wheelhouse. Both refs are

# empty on a non-thin member (var/secret unset) - the mint is skipped

# and the fetch no-ops. A thin member sets a dedicated read-only App's

# client-id var + private-key secret.

payload-token-client-id: ${{ vars.SOCKET_PAYLOAD_CLIENT_ID }}

payload-token-private-key: ${{ secrets.SOCKET_PAYLOAD_APP_PRIVATE_KEY }}

# Cache the model components + activation state ONLY — the same set the

# bridge's clone mode copies from a system profile. The rest of the

# user-data-dir is Chrome litter (GPU/code caches, crashpad) that would

# grow the entry on every weekly refill without bounding benefit.

- name: Restore any prior model profile

shell: bash

run: |

set -euo pipefail

node scripts/fleet/cache/restore.mts \

--path "/home/runner/.cache/odai/chrome-builtin/OptGuideOnDeviceModel" \

--path "/home/runner/.cache/odai/chrome-builtin/optimization_guide_model_store" \

--path "/home/runner/.cache/odai/chrome-builtin/OptGuideOnDeviceClassifierModel" \

--path "/home/runner/.cache/odai/chrome-builtin/Local State" \

--key "odai-nano-Linux-x64-fill-anchor" \

--restore-key "odai-nano-Linux-x64-"

- name: Build the CLI

shell: bash

run: pnpm run build

# First activation of a fresh profile needs network for one keyless

# component-metadata exchange; with a restored profile the download is

# skipped and this doubles as the warm-path timing receipt.

- name: Fill + first prompt (download allowed)

shell: bash

env:

ODAI_CHROME_ALLOW_DOWNLOAD: '1'

ODAI_CHROME_USER_DATA_DIR: /home/runner/.cache/odai/chrome-builtin

run: |

set -euo pipefail

printf '%s\n' \

'The fleet cascade synchronizes template-owned files across member' \

'repositories. Each wave reads the committed template state, writes' \

'byte-identical copies into every member, and commits the result' \

'with a receipt naming the template commit it mirrors. Drift between' \

'a template file and a member copy is a defect the next wave heals.' \

> /tmp/on-device-model-cache-input.txt

START="$(date +%s)"

node dist/cli.js summarize --backend chrome-builtin \

--input /tmp/on-device-model-cache-input.txt --timeout 240000 \

> /tmp/on-device-model-cache-fill.json

ELAPSED="$(( $(date +%s) - START ))"

node -e '

const fs = require("node:fs")

const r = JSON.parse(fs.readFileSync("/tmp/on-device-model-cache-fill.json", "utf8"))

if (typeof r.summary !== "string" || r.summary.length === 0) {

console.error("on-device-model-cache: summarize reply carries no summary string.")

process.exit(1)

}

console.log("summary:", r.summary)

echo "fill prompt wall time: ${ELAPSED}s"

node dist/cli.js backends || true

du -sh /home/runner/.cache/odai/chrome-builtin

- name: Read the component version

id: component

shell: bash

run: |

set -euo pipefail

DIR=/home/runner/.cache/odai/chrome-builtin/OptGuideOnDeviceModel

if [ ! -d "$DIR" ]; then

echo "::error::on-device-model-cache: no model component after the fill." >&2

echo "::error::Where: $DIR on the fill runner." >&2

echo "::error::Saw vs wanted: directory absent; wanted one <component-version> subdir." >&2

echo "::error::Fix: read the fill-step log — availability() reasons are printed by the CLI." >&2

exit 1

VERSION="$(ls "$DIR" | head -1)"

echo "version=${VERSION}" >> "$GITHUB_OUTPUT"

echo "cache-key=odai-nano-Linux-x64-${VERSION}" >> "$GITHUB_OUTPUT"

echo "component version: ${VERSION}"

- name: Save the profile cache

shell: bash

env:

CACHE_KEY: ${{ steps.component.outputs.cache-key }}

run: |

set -euo pipefail

node scripts/fleet/cache/save.mts \

--path "/home/runner/.cache/odai/chrome-builtin/OptGuideOnDeviceModel" \

--path "/home/runner/.cache/odai/chrome-builtin/optimization_guide_model_store" \

--path "/home/runner/.cache/odai/chrome-builtin/OptGuideOnDeviceClassifierModel" \

--path "/home/runner/.cache/odai/chrome-builtin/Local State" \

--key "$CACHE_KEY"

verify:

needs: fill

runs-on: ubuntu-latest

timeout-minutes: 20

steps:

- name: Bootstrap checkout

shell: bash

env:

GITHUB_TOKEN: ${{ github.token }}

SERVER_URL: ${{ github.server_url }}

REPOSITORY: ${{ github.repository }}

TRIGGER_REF: ${{ github.ref }}

run: |

set -euo pipefail

git init -q

git config --local advice.detachedHead false

git remote remove origin 2>/dev/null || true

git remote add origin "${SERVER_URL}/${REPOSITORY}"

FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}")

if [ -n "${GITHUB_TOKEN}" ]; then

AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"

git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}"

else

git fetch "${FETCH_ARGS[@]}"

git checkout -q --detach FETCH_HEAD

# This job is the CONSUMER REFERENCE SHAPE: no disk reclaim (the 22 GB

# free-space need is download-time only; a restore-only job holds 4.2 GB

# against the image's ~88 GB free, comfortably over Chrome's 10 GB model

# retention floor) and no unconditional Chrome upgrade. One deliberate

# difference from a real consumer: this repo's verify builds the CLI

# from HEAD to validate the checkout; consumers install the published

# @socketsecurity/odai instead.

- name: Ensure Google Chrome stable

shell: bash

run: |

set -euo pipefail

if command -v google-chrome-stable >/dev/null 2>&1; then

echo "preinstalled: $(google-chrome-stable --version)"

exit 0

wget -q https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb

sudo apt-get install -y ./google-chrome-stable_current_amd64.deb

rm google-chrome-stable_current_amd64.deb

google-chrome-stable --version

- uses: ./.github/actions/fleet/setup-and-install

with:

socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}

# Thin-distribution CI auth: mint a contents:read-only token so the

# bootstrap fetch (fired by `prepare` during install) can download the

# fleet release bundle from the private wheelhouse. Both refs are

# empty on a non-thin member (var/secret unset) - the mint is skipped

# and the fetch no-ops. A thin member sets a dedicated read-only App's

# client-id var + private-key secret.

payload-token-client-id: ${{ vars.SOCKET_PAYLOAD_CLIENT_ID }}

payload-token-private-key: ${{ secrets.SOCKET_PAYLOAD_APP_PRIVATE_KEY }}

- name: Restore the filled profile (miss = failure)

shell: bash

env:

CACHE_KEY: ${{ needs.fill.outputs.cache-key }}

run: |

set -euo pipefail

node scripts/fleet/cache/restore.mts \

--path "/home/runner/.cache/odai/chrome-builtin/OptGuideOnDeviceModel" \

--path "/home/runner/.cache/odai/chrome-builtin/optimization_guide_model_store" \

--path "/home/runner/.cache/odai/chrome-builtin/OptGuideOnDeviceClassifierModel" \

--path "/home/runner/.cache/odai/chrome-builtin/Local State" \

--key "$CACHE_KEY" \

--fail-on-miss

- name: Build the CLI

shell: bash

run: pnpm run build

- name: Prompt with downloads off

shell: bash

env:

ODAI_CHROME_USER_DATA_DIR: /home/runner/.cache/odai/chrome-builtin

run: |

set -euo pipefail

printf '%s\n' \

'A worktree keeps branch work out of the primary checkout. Each' \

'worktree shares the same object store but holds its own files,' \

'so an agent can build and test a feature branch in isolation' \

'while the default branch stays clean for other sessions.' \

> /tmp/on-device-model-cache-verify.txt

START="$(date +%s)"

node dist/cli.js summarize --backend chrome-builtin \

--input /tmp/on-device-model-cache-verify.txt --timeout 240000 \

> /tmp/on-device-model-cache-verify.json

ELAPSED="$(( $(date +%s) - START ))"

node -e '

const fs = require("node:fs")

const r = JSON.parse(fs.readFileSync("/tmp/on-device-model-cache-verify.json", "utf8"))

if (typeof r.summary !== "string" || r.summary.length === 0) {

console.error("on-device-model-cache: offline summarize reply carries no summary string.")

process.exit(1)

}

console.log("summary:", r.summary)

echo "restored-profile prompt wall time: ${ELAPSED}s"

socket-cli/.github/workflows/on-device-model-cache.yml at main · SocketDev/socket-cli · GitHub

Uh oh!

Expand file tree

Breadcrumbs

on-device-model-cache.yml

Latest commit

History

Breadcrumbs

on-device-model-cache.yml

File metadata and controls